CVE-2014-3577

Aliases:GHSA-cfh5-3ghh-wfjxRHSA-2014:1082RHSA-2014:1146RHSA-2014:1166DEBIAN-CVE-2014-3577CGA-28x8-w4h4-4mrwCGA-4ffm-c5f5-59jxCGA-543q-f2v9-h5q6CGA-5j8h-553m-m2ppCGA-5vcv-mxwf-4qggCGA-855x-9cjv-8rj4CGA-8r98-p4q3-89jwCGA-p8pp-r7mf-w9gfCGA-qxhq-vrxx-6pfgCGA-rqqx-9jwx-mm72CGA-w2vq-gm62-32pvCGA-xh9m-cc5r-pvrmCGA-6rhv-99x9-fggfCGA-8jrq-725j-88p4CGA-chv2-2c93-r684CGA-j989-5vq7-2pchCGA-mj3g-p72q-hg5hCGA-vrww-xh6c-p393CGA-xf9q-r48p-8jfqCGA-4m42-5qf2-7w2pCGA-4q3v-w76x-v43cCGA-65mw-3jhw-ccgcCGA-8jj9-jmr2-wcxpCGA-8q4h-mjhp-6crxCGA-93m3-j4fx-xrgvCGA-c8q7-389p-xg6gCGA-f2rv-5mfw-2f53CGA-m5vw-v3j7-56fmCGA-wmg6-hw22-vxrjCGA-4wqg-849c-mr68CGA-hc26-q9w4-96hvCGA-mr72-pfx6-f8rj
Advisory lineage Upstream: 0 Downstream: 24
Modified
Published: 21 Aug 2014, 00:00
Last modified:06 Aug 2024, 10:50

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
5.8 MEDIUM
v2.0 (nvd)
EPSS Score
9.15% LOW
9% probability +7.78%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

21 Aug 2014, 00:00
Published
Vulnerability first disclosed
06 Aug 2024, 10:50
Last Modified
Vulnerability information updated

Description

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

CVSS Metrics

  • v3.0•MEDIUM•Score: 4.8CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
  • v2.0•MEDIUM•Score: 5.8AV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS Trends

Current EPSS score: 9.15%• Percentile: 95%

Affected Systems

  • apache•httpasyncclient

    ≥ 4.0, ≤ 4.0.1

  • apache•httpclient

    ≥ 4.0, ≤ 4.3.4

  • chainguard•eco-java-gradle-1.11

    all

  • chainguard•eco-java-gradle-2.0

    all

  • chainguard•eco-java-gradle-2.1

    all

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.2

    all

  • chainguard•eco-java-gradle-2.2.1

    all

  • chainguard•eco-java-gradle-2.3

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•hadoop-fips-3.3.6

    all

  • chainguard•hadoop-fips-3.4.2

    all

  • chainguard•hadoop-fips-3.5

    all

  • debian•commons-httpclient

    < 3.1-11 | < 3.1-11 | < 3.1-11 | < 3.1-11

  • debian•httpcomponents-client

    < 4.3.5-1 | < 4.3.5-1 | < 4.3.5-1 | < 4.3.5-1

  • org.apache.httpcomponents•httpclient

    < 4.3.5

  • redhat•httpcomponents-client

    < 0:4.2.5-5.el7_0 | < 0:4.2.5-5.el7_0 | < 0:4.2.5-5.el7_0 | < 0:4.2.5-5.el7_0

  • redhat•httpcomponents-client-javadoc

    < 0:4.2.5-5.el7_0 | < 0:4.2.5-5.el7_0 | < 0:4.2.5-5.el7_0 | < 0:4.2.5-5.el7_0

  • redhat•jakarta-commons-httpclient

    < 1:3.0-7jpp.4.el5_10 | < 1:3.0-7jpp.4.el5_10 | < 1:3.0-7jpp.4.el5_10 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0

  • redhat•jakarta-commons-httpclient-debuginfo

    < 1:3.0-7jpp.4.el5_10 | < 1:3.0-7jpp.4.el5_10 | < 1:3.0-7jpp.4.el5_10 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5

  • redhat•jakarta-commons-httpclient-demo

    < 1:3.0-7jpp.4.el5_10 | < 1:3.0-7jpp.4.el5_10 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0

  • redhat•jakarta-commons-httpclient-javadoc

    < 1:3.0-7jpp.4.el5_10 | < 1:3.0-7jpp.4.el5_10 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0

  • redhat•jakarta-commons-httpclient-manual

    < 1:3.0-7jpp.4.el5_10 | < 1:3.0-7jpp.4.el5_10 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-0.9.el6_5 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0 | < 1:3.1-16.el7_0

  • redhat•thermostat1-httpcomponents-client

    < 0:4.2.5-3.4.el6.1

  • redhat•thermostat1-httpcomponents-client-javadoc

    < 0:4.2.5-3.4.el6.1

References (73)